ip6_fragment, in case skb has a fraglist, checks if theskb is cloned. If it is, it will move to the 'slow path' and allocatesnew skbs for each fragment.

However, right before entering the slowpath loop, it updates thenexthdr value of the last ipv6 extension header to NEXTHDR_FRAGMENT,to account for the fragment header that will be inserted in the newipv6-fragment skbs.

In case original skb is cloned this munges nexthdr value of anotherskb. Avoid this by doing the nexthdr update for each of the new fragmentskbs separately.

This was observed with tcpdump on a bridge device where netfilter ipv6reassembly is active: tcpdump shows malformed fragment headers asthe l4 header (icmpv6, tcp, etc). is decoded as a fragment header.